Splunk Search

How to Capture Both Matched and Unmatched Events After a Lookup Filter

krishna1
Explorer

I'm working with a query where I'm using a lookup to enrich events based on the work_queue field and then filtering to pass forward only those events with a matching entry in the lookup file.

Here’s a simplified version of my query:

index="acn_ticket_summary" 
| lookup Master.csv "AssignmentGroup" as work_queue outputnew Desk_Ind, cdl_gs, Support_Team
| where isnotnull(work_queue)


This filters the events, keeping only those that have a non-null work_queue after the lookup.

Requirement: I also need to capture the events that don’t match (i.e., those that result in isnull(work_queue)) for separate calculations. Is there a way to modify my query to keep both the matched and unmatched events?

Thank you in advance for your help!

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @krishna1 ,

you have only to remove the filter (where command).

Eventually, you could add a calculation (eval command) to indicate if an event is matching or not, but probably isn't relevant because the matching ones have a value in the work_queue field.

Ciao.

Giuseppe 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...